django-verification

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes hardcoded credentials and explicit secret values (e.g., DJANGO_SECRET_KEY: test-secret-key, DATABASE_URL with user:password, and an echoed superuser password), which require the agent to handle or reproduce secrets verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The GitHub Actions used in the CI workflow (e.g., actions/checkout@v3, actions/setup-python@v4, actions/cache@v3, codecov/codecov-action@v3 — i.e. github.com/actions/checkout, github.com/actions/setup-python, github.com/actions/cache, github.com/codecov/codecov-action) and the postgres:14 container image are fetched and executed at CI runtime, so they constitute runtime external dependencies that execute remote code.